# Phishing domains under .io

.io accounts for 9,126 of the 224,866 domains in the PhishDestroy database (4.06%), with 42 new ones in the last 30 days. The most impersonated brand under .io is Netflix. 2,845 were online at the last check and 2,046 have a confirmed takedown.

9,126Reported .io domains

4.06%Share of PhishDestroy reports

42Last 30 days

2,046Confirmed takedowns

## Detections per month

.io phishing domains detected per month: 8,670 from 2025-11 to 2026-10; peak 1,352.

## Brands and registrars

### Impersonated brands

- [Netflix](https://phishdestroy.io/brand/netflix/)656
- [MetaMask](https://phishdestroy.io/brand/metamask/)494
- [Amazon](https://phishdestroy.io/brand/amazon/)476
- [Google](https://phishdestroy.io/brand/google/)337
- [Trezor](https://phishdestroy.io/brand/trezor/)327
- [KuCoin](https://phishdestroy.io/brand/kucoin/)323
- [Ledger](https://phishdestroy.io/brand/ledger/)303
- [Coinbase](https://phishdestroy.io/brand/coinbase/)179

### Registrars

- GitHub2,909
- Webflow1,047
- [MarkMonitor](https://phishdestroy.io/registrar/markmonitor/)1,033
- [NameCheap](https://phishdestroy.io/registrar/namecheap/)531
- [1API](https://phishdestroy.io/registrar/1api-gmbh/)449
- Cloudflare407
- Cloudflare313
- [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)301

## Latest .io phishing domains

The 30 most recently detected .io domains
Domain | First detected | Status at last check | Registrar | 
[trezorinspect.io](https://phishdestroy.io/domain/trezorinspect.io/) | 2026-10-20 | Online | NETIM | 
[trezorsafety.io](https://phishdestroy.io/domain/trezorsafety.io/) | 2026-10-20 | Online | NETIM | 
[trezorcheckup.io](https://phishdestroy.io/domain/trezorcheckup.io/) | 2026-10-20 | Online | NETIM | 
[ccreator.io](https://phishdestroy.io/domain/ccreator.io/) | 2026-10-19 | Offline | GoDaddy.com | 
[solanatools.io](https://phishdestroy.io/domain/solanatools.io/) | 2026-10-19 | Online | Porkbun | 
[io-bridge.io](https://phishdestroy.io/domain/io-bridge.io/) | 2026-10-19 | Online | Megazone , dba HOSTING.KR | 
[arguspad.io](https://phishdestroy.io/domain/arguspad.io/) | 2026-10-16 | Online | — | 
[etherscens.io](https://phishdestroy.io/domain/etherscens.io/) | 2026-10-15 | Online | Cloudflare | 
[eventexpress.io](https://phishdestroy.io/domain/eventexpress.io/) | 2026-10-12 | Online | GoDaddy.com | 
[dexmines.io](https://phishdestroy.io/domain/dexmines.io/) | 2026-10-12 | Online | NICENIC | 
[827262-trezor.io](https://phishdestroy.io/domain/827262-trezor.io/) | 2026-10-11 | Online | NICENIC | 
[reach-trezor.io](https://phishdestroy.io/domain/reach-trezor.io/) | 2026-10-11 | Online | OwnRegistrar | 
[fxrprotocol.io](https://phishdestroy.io/domain/fxrprotocol.io/) | 2026-10-11 | Online | Dynadot | 
[gramx.io](https://phishdestroy.io/domain/gramx.io/) | 2026-10-09 | Online | NAMECHEAP | 
[uniswaps-apps.io](https://phishdestroy.io/domain/uniswaps-apps.io/) | 2026-10-08 | Online | TLD Registrar Solutions | 
[hyperliquid-exchanges.io](https://phishdestroy.io/domain/hyperliquid-exchanges.io/) | 2026-10-08 | Online | TLD Registrar Solutions | 
[ledger-live-applications.io](https://phishdestroy.io/domain/ledger-live-applications.io/) | 2026-10-08 | Online | TLD Registrar Solutions | 
[earntask.io](https://phishdestroy.io/domain/earntask.io/) | 2026-10-07 | Online | NAMECHEAP | 
[genesis-raydium.io](https://phishdestroy.io/domain/genesis-raydium.io/) | 2026-10-06 | Online | NICENIC | 
[metamaskteam.io](https://phishdestroy.io/domain/metamaskteam.io/) | 2026-10-04 | Online | ENOM | 
[lendprotocol.io](https://phishdestroy.io/domain/lendprotocol.io/) | 2026-10-03 | Online | Eranet | 
[bittensor-dapp.io](https://phishdestroy.io/domain/bittensor-dapp.io/) | 2026-10-03 | Online | Name.com | 
[legder.desktop-wallet.io](https://phishdestroy.io/domain/legder.desktop-wallet.io/) | 2026-09-28 | Online | TLD Registrar Solutions | 
[surgehq.io](https://phishdestroy.io/domain/surgehq.io/) | 2026-09-28 | Online | NAMECHEAP | 
[comfy-ui.io](https://phishdestroy.io/domain/comfy-ui.io/) | 2026-09-28 | Online | Spaceship | 
[playgym.io](https://phishdestroy.io/domain/playgym.io/) | 2026-09-28 | Online | GoDaddy.com | 
[defiart.io](https://phishdestroy.io/domain/defiart.io/) | 2026-09-27 | Unknown | NICENIC | 
[gigabooster.io](https://phishdestroy.io/domain/gigabooster.io/) | 2026-09-27 | Online | DonDominio (SCIP) | 
[portal.incentiv.io](https://phishdestroy.io/domain/portal.incentiv.io/) | 2026-09-27 | Online | GoDaddy.com | 
[bittumbler.io](https://phishdestroy.io/domain/bittumbler.io/) | 2026-09-26 | Online | NICENIC | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .io registrations; first .io report 2024-03-20.

Canonical: https://phishdestroy.io/tld/io/